Snapshot: full project state

SITE_SPEC.md

@@ -0,0 +1,25 @@
+# THREATMARKET — Threat Intel Data Marketplace
+
+Public catalog + paid archive of REAL threat intelligence harvested by the fleet.
+Customers browse sample data, pay sats/BTC via BTCPay, download auto-zipped intel packs.
+
+## Business model
+- Fleet tools (OSINT Terminal 454 tools, Lynx, Argus, research engine, market-intel crawls)
+  continuously enumerate REAL data: subdomains, exposed services, cert transparency, breach
+  indicators, newly-registered domains, market/lead datasets.
+- Auto-pipeline (2x daily) packages a fresh intel pack from a RANDOM website/company
+  and archives it as a zip: /opt/threatmarket/archive/<domain>-<date>.zip
+- Each pack = structured JSON/CSV (not made-up data — only real findings from real scans)
+- Site lists archive metadata (domain, date, finding counts, categories) WITHOUT the payload.
+  Buyer pays BTCPay -> webhook -> zip unlocked for browser download (one-time link).
+
+## Stack
+- CT TBD "threatmarket" (Debian 12), Flask + nginx :80->app
+- BTCPay store + webhook (payment confirmed -> unlock zip)
+- Gitea repo, Umami beacon, BMAC footer, agent SEO (llms.txt)
+- Cron: 2x daily random-target intel pack generation
+
+## Rules
+- ZERO fabricated data. Every finding must come from a real scan run by real fleet tools.
+- If a scan produces nothing, the pack says so. No filler, no example rows.
+- Public pages show counts/metadata only; payloads only after payment.